CVE-2026-92230

UNKNOWN 0.0

Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded Metaspace growth and eventual denial of service of the Karaf instance.

CWE	CWE-401 CWE-772
Vendor	apache software foundation
Product	apache karaf
Published	Sep 17, 2026
Last Updated	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache karaf

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache karaf are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Karaf

0 < 4.4.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/pxgqjvsmzgpvgly1qf1w300qxsp8bxdj openwall.com: http://www.openwall.com/lists/oss-security/2026/09/17/3

Credits

🔍 Baoquan Cui & Yucheng Qiu